Not rated
CVE-2022-1245 A privilege escalation flaw was found in the token exchange feature of keycloak
Description
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Keycloak | Versions not published |
Other CVEs of Keycloak
The 36 CVEs of Keycloak →
CVE-2023-4918
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile
8.8
High
CVE-2023-1664
A flaw was found in Keycloak
6.5
Medium
CVE-2022-1274
A flaw was found in Keycloak in the execute-actions-email endpoint
Not rated
CVE-2022-2237
A flaw was found in the Keycloak Node.js Adapter
6.1
Medium